add:create cleanify into utils modules

CHANGES.rst

@@ -6,6 +6,13 @@ Changelog
 
 Release date: -
 
+0.5.2
+-----
+
+Release date: 2023/12/09
+
+- add ``cleanify`` function to ``flask_ckeditor.utils``
+
 
 0.5.1
 -----

flask_ckeditor/utils.py

@@ -1,8 +1,13 @@
 import os
 import uuid
-
+import warnings
 from flask import url_for
 
+try:
+    import bleach
+except ImportError:
+    warnings.warn('bleach is not installed,`cleanify` function will not be available')
+
 
 def get_url(endpoint_or_url):
     if endpoint_or_url.startswith(('https://', 'http://', '/')):
@@ -15,3 +20,20 @@
     ext = os.path.splitext(old_filename)[1]
     new_filename = uuid.uuid4().hex + ext
     return new_filename
+
+
+def cleanify(text, *, allow_tags=None):
+    """clean the input from client, this function rely on bleach,
+
+
+    Args:
+        text (str): input
+        allow_tags (Iterable[str], optional): if you don't want to use default `allow_tags`
+            you can provide a Iterable which include html tag string like ['a', 'li',...]
+    """
+    if allow_tags:
+        return bleach.linkify(bleach.clean(text, tags=allow_tags))
+    default_allowed_tags = {'a', 'abbr', 'b', 'blockquote', 'code',
+                            'em', 'i', 'li', 'ol', 'pre', 'strong', 'ul',
+                            'h1', 'h2', 'h3', 'h4', 'h5', 'p'}
+    return bleach.linkify(bleach.clean(text, tags=default_allowed_tags))

requirements/dev.txt

@@ -164,7 +164,7 @@ wtforms==3.1.1
     # via
     #   flask-admin
     #   flask-wtf
-
+bleach==6.1.0
 # The following packages are considered to be unsafe in a requirements file:
 # pip
 # setuptools

requirements/example.txt

@@ -48,3 +48,4 @@ wtforms==3.1.1
     # via
     #   flask-admin
     #   flask-wtf
+

requirements/tests.in

@@ -5,3 +5,4 @@ flask-wtf
 flask-admin
 flask-sqlalchemy
 tablib
+bleach

requirements/tests.txt

@@ -61,3 +61,4 @@ wtforms==3.1.1
     # via
     #   flask-admin
     #   flask-wtf
+bleach==6.1.0

test_flask_ckeditor.py

@@ -14,6 +14,7 @@
 from flask_wtf import FlaskForm, CSRFProtect
 
 from flask_ckeditor import CKEditorField, _CKEditor, CKEditor, upload_success, upload_fail
+from flask_ckeditor.utils import cleanify
 
 
 class CKEditorTestCase(unittest.TestCase):
@@ -287,6 +288,48 @@ def test_upload_fail(self):
             {'uploaded': 0, 'error': {'message': 'new error message'}}
         )
 
+    def test_cleanify_input_js(self):
+        input = 'an <script>evil()</script> example'
+        clean_ouput = cleanify(input)
+        self.assertEqual(clean_ouput,
+                         u'an &lt;script&gt;evil()&lt;/script&gt; example')
+
+    def test_cleanify_input_url(self):
+        input = 'abc http://example.com def'
+        clean_output = cleanify(input)
+        self.assertEqual(clean_output,
+                         u'abc <a href="http://example.com" rel="nofollow">http://example.com</a> def')
+
+    def test_cleanify_by_allow_tags(self):
+        input = '<b> hello <a> this is a url </a> !</b> <h1> this is h1 </h1>'
+        clean_out = cleanify(input, allow_tags=['b'])
+        self.assertEqual(clean_out,
+                         '<b> hello &lt;a&gt; this is a url &lt;/a&gt; !</b> &lt;h1&gt; this is h1 &lt;/h1&gt;')
+
+    def test_cleanify_by_default_allow_tags(self):
+        self.maxDiff = None
+        input = """<a>xxxxx</a>
+                <abbr>xxxxx</abbr>
+                <b>xxxxxxx</b>
+                <blockquote>xxxxxxx</blockquote>
+                <code>print(hello)</code>
+                <em>xxxxx</em>
+                <i>xxxxxx</i>
+                <li>xxxxxx</li>
+                <ol>xxxxxx</ol>
+                <pre>xxxxxx</pre>
+                <strong>xxxxxx</strong>
+                <ul>xxxxxx</ul>
+                <h1>xxxxxxx</h1>
+                <h2>xxxxxxx</h2>
+                <h3>xxxxxxx</h3>
+                <h4>xxxxxxx</h4>
+                <h5>xxxxxxx</h5>
+                <p>xxxxxxxx</p>
+        """
+        clean_out = cleanify(input)
+        self.assertEqual(clean_out, input)
+
 
 if __name__ == '__main__':
     unittest.main()

tox.ini

@@ -10,6 +10,7 @@ deps =
     pytest
     coverage
     flask_wtf
+    bleach
 
 [testenv:coverage]
 commands =